Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,598
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

958 advisories

Loading
Hazelcast allows arbitrary member memory access by low-privileged client Critical
CVE-2026-107726 was published for com.hazelcast:hazelcast (Maven) Oct 8, 2026
k-jamroz Credited to k-jamroz
AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host Critical
CVE-2026-107282 was published for org.asynchttpclient:async-http-client (Maven) Oct 8, 2026
Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path Critical
CVE-2026-103922 was published for @capacitor/android (Maven) Oct 5, 2026
andredestro Credited to andredestro
http4s-scala-xml has an XML External Entity (XXE) processing issue Critical
CVE-2026-61741 was published for org.http4s:http4s-scala-xml_2.12 (Maven) Sep 24, 2026
rossabaker Credited to rossabaker and samspills samspills samspills
Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bug Critical
CVE-2026-85724 was published for io.moquette:moquette-broker (Maven) Sep 23, 2026
gigioneggiando Credited to gigioneggiando
org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue Critical
CVE-2025-53837 was published for org.xwiki.rendering:xwiki-rendering-xml (Maven) Sep 18, 2026
Http4s Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling) Critical
CVE-2026-69204 was published for org.http4s:http4s-ember-core_2.12 (Maven) Sep 15, 2026
ERobertGII Credited to ERobertGII and rossabaker rossabaker rossabaker
Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover Critical
CVE-2026-11746 was published for com.linecorp.centraldogma:centraldogma-server (Maven) Sep 11, 2026
Apache FreeMarker template loading mechanism vulnerable to path traversal Critical
CVE-2026-84939 was published for org.freemarker:freemarker (Maven) Sep 10, 2026
oscerd Credited to oscerd and hypoflex hypoflex hypoflex
Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext Critical
CVE-2026-75595 was published for io.netty:netty-handler (Maven) Sep 8, 2026
violetagg Credited to violetagg
Yamcs vulnerable to authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`) Critical
CVE-2026-55565 was published for org.yamcs:yamcs-core (Maven) Aug 28, 2026
Marnick39 Credited to Marnick39
Yamcs vulnerable to Remote Code Execution via instance-template argument YAML injection (createInstance) Critical
CVE-2026-55559 was published for org.yamcs:yamcs-core (Maven) Aug 28, 2026
MarkLee131 Credited to MarkLee131 and manus-use manus-use manus-use
Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql` Critical
CVE-2026-55511 was published for org.yamcs:yamcs-core (Maven) Aug 28, 2026
Yanchon918s Credited to Yanchon918s and manus-use manus-use manus-use
Spring Framework Improper Path Limitation in XsltView Critical
CVE-2026-47884 was published for org.springframework:spring-webmvc (Maven) Aug 27, 2026
julianladisch Credited to julianladisch
Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints Critical
CVE-2026-47892 was published for org.springframework:spring-webflux (Maven) Aug 27, 2026
Spring Framework Server Sent Event stream corruption while rendering fragments Critical
CVE-2026-47890 was published for org.springframework:spring-webflux (Maven) Aug 27, 2026
Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability Critical
CVE-2026-65182 was published for org.apache.tomcat.embed:tomcat-embed-core (Maven) Aug 26, 2026
oscerd Credited to oscerd
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability Critical
CVE-2026-65905 was published for org.apache.tomcat.embed:tomcat-embed-core (Maven) Aug 26, 2026
oscerd Credited to oscerd
Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability Critical
CVE-2026-68525 was published for org.apache.tomcat.embed:tomcat-embed-core (Maven) Aug 26, 2026
oscerd Credited to oscerd
Apache Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes Critical
CVE-2026-78329 was published for org.apache.camel:camel-undertow (Maven) Aug 24, 2026
oscerd Credited to oscerd
Apache Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir Critical
CVE-2026-66906 was published for org.apache.camel:camel-azure-storage-blob (Maven) Aug 24, 2026
oscerd Credited to oscerd
Apache Camel-Atmosphere-Websocket: WebSocket dispatch header injection - the producer selected its target peers through Exchange headers whose names sat outside the filtered Camel namespace Critical
CVE-2026-71300 was published for org.apache.camel:camel-atmosphere-websocket (Maven) Aug 24, 2026
oscerd Credited to oscerd
GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers Critical
CVE-2026-76904 was published for org.geotools.jdbc:gt-jdbc-postgis (Maven) Aug 21, 2026
qquang Credited to qquang, mrlihd, PhilipPhil, Quikko, jodygarnett, h1ei1, and 4ra1n mrlihd mrlihd
PhilipPhil PhilipPhil Quikko Quikko jodygarnett jodygarnett h1ei1 h1ei1 4ra1n 4ra1n
Keycloak: Unauthenticated account takeover via reset-credentials flow bypass Critical
CVE-2026-18963 was published for org.keycloak:keycloak-services (Maven) Aug 18, 2026
madmuffin1 Credited to madmuffin1, greiffmode, and pv-rudger greiffmode greiffmode
pv-rudger pv-rudger
Apache Ranger has a Command Injection vulnerability Critical
CVE-2026-28672 was published for org.apache.ranger:ranger (Maven) Aug 10, 2026
oscerd Credited to oscerd
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database